Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-829.
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| orval-labs | orval | before 8.22.0 | 8.22.0 | Patch available | CNA |
| — | orval (npm) | before 8.22.0 | 8.22.0 | Patch available | GHSA-cxq5-97v7-87j8 |
- orval Vendororval-labs Affected before 8.22.0 Fixed in 8.22.0 Patch available CNA
- orval (npm) Vendor— Affected before 8.22.0 Fixed in 8.22.0 Patch available GHSA-cxq5-97v7-87j8
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* | — | — | orval-labs |
- cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* Versions — — ·orval-labs
Remediation
- Fix · CNA orval (orval-labs) Fixed in 8.22.0
- Fix · GHSA-cxq5-97v7-87j8 orval (npm) Fixed in 8.22.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-62680
- 2026-10-03 Alias added: GHSA-cxq5-97v7-87j8
References
Other 7
- https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8
- https://github.com/orval-labs/orval/pull/3723
- https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10
- https://github.com/orval-labs/orval/releases/tag/v8.22.0
- https://github.com/orval-labs/orval/pull/3692
- https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
- https://github.com/orval-labs/orval
More orval-labs vulnerabilities
- TI-2026-63855 orval before 8.29.0 Code Injection via operationId CVSS 4.0CRITICAL 9.3
- TI-2026-63854 orval @orval/core before 8.28.0 Code Injection via Form-Data CVSS 4.0CRITICAL 9.3
- TI-2026-63853 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type CVSS 4.0CRITICAL 9.3
- TI-2026-63850 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path CVSS 4.0CRITICAL 9.3
- TI-2026-50952 Orval: Import-time RCE via schema default -> zod module-level template literal CVSS 4.0CRITICAL 9.3
- TI-2026-50951 Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-62680 · CVE Program
- CVE-2026-62680 · NVD
- FIRST EPSS
- GHSA-cxq5-97v7-87j8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences